DOMpurify has a nesting-based mXSS

🗓️ 11 Oct 2024 17:27:29Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 292 Views

DOMpurify mXSS vulnerability fi

Reporter	Title	Published	Views	Family All 142
GithubExploit	Exploit for CVE-2024-47875	2 Sep 202514:50	–	githubexploit
IBM Security Bulletins	Security Bulletin: User Behavior Analytics application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	20 Nov 202413:56	–	ibm
IBM Security Bulletins	Security Bulletin: Critical Fixes for IBM Storage Defender - Data Protect included in 2.0.15	21 Jul 202516:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in DOMPurify	2 May 202518:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i is affected by a cross-site scripting vulnerability in Navigator for i [CVE-2024-47875]	18 Dec 202522:22	–	ibm
IBM Security Bulletins	Security Bulletin: BM Sterling Connect:Direct Web Services is affected by DOMPurify vulnerability (CVE-2024-47875)	22 Nov 202412:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 24.0.0-IF006 (July 2025)	8 Aug 202515:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data (January 2025)	3 Apr 202523:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	15 Apr 202503:11	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	8 Nov 202408:08	–	ibm

Vulners

Node

cure53 dompurifyRange3.0.0–3.1.3npm

Source	Link
github	www.github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-47875
github	www.github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f
github	www.github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a
github	www.github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js
lists	www.lists.debian.org/debian-lts-announce/2025/02/msg00010.html
seclists	www.seclists.org/fulldisclosure/2025/Apr/14
github	www.github.com/advisories/GHSA-gx9m-whjm-85jf

03 Nov 2025 22:48Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.16.1 - 10

EPSS0.00699

SSVC